CISA · Question #171
Which of the following is the BEST indication that an information security awareness program is effective?
The correct answer is B. A reduction in the success rate of social engineering attacks. The goal of a security awareness program is to change employee behavior so they can recognize and resist attacks. A reduction in the success rate of social engineering attacks (B) directly measures this behavioral change - it shows that employees are correctly identifying and…
Question
Which of the following is the BEST indication that an information security awareness program is effective?
Options
- AA reduction in the number of reported information security incidents
- BA reduction in the success rate of social engineering attacks
- CA reduction in the cost of maintaining the information security program
- DA reduction in the number of information security attacks
How the community answered
(23 responses)- A13% (3)
- B74% (17)
- C4% (1)
- D9% (2)
Explanation
The goal of a security awareness program is to change employee behavior so they can recognize and resist attacks. A reduction in the success rate of social engineering attacks (B) directly measures this behavioral change - it shows that employees are correctly identifying and rejecting manipulation attempts. A reduction in reported incidents (A) is misleading because it could indicate underreporting rather than fewer actual incidents. A reduction in program cost (C) measures efficiency, not effectiveness. A reduction in the total number of attacks (D) is largely outside the organization's control, as threat actors operate independently of internal training efforts.
Topics
Community Discussion
No community discussion yet for this question.